Evidence
This page explains what counts as proof on a control: what you can attach, which things RiskFlow checks for you, and how it decides a control is Passing, Failing or Needs evidence.
The idea in one minute
A control says "we do this". Evidence is how you show it. RiskFlow already holds most of that proof: your signed policies, finished training, signed BAAs and uploaded files. So you don't type anything twice. You point the control at the thing, and RiskFlow checks it for you, every time something changes and once a day.
- Attach a document, a policy, a training or a written note to a control. Or upload a file straight onto the control.
- RiskFlow turns the control green or red from what it finds. You never set a status by hand.
- Proof goes stale by itself. An expired document or an unsigned policy turns the control away from green without anyone remembering to look.
- Business associate agreements are checked automatically. There is nothing to attach.
- The readiness score on Frameworks moves with all of it.
Who can do what
| Role | Evidence |
|---|---|
| ORG Admin | See, attach, upload, change the expiry, remove |
| ORG Auditor | See everything. Read-only |
| Other ORG roles | No access to Controls |
Each clinic sees only its own controls and evidence. Another clinic, even one managed by the same MSP, can't see yours, and asking for it behaves as if it doesn't exist.
What you can attach
Open a control and select Add evidence.
| Kind | Points at | Counts as proof when |
|---|---|---|
| Document | A file in Documents, or a new upload | It has not expired |
| Policy | A policy in Policies and procedures | The people asked to sign it have signed the current version |
| Training | A training | Enough of the people assigned it have finished it |
| Note | Just text, for example "Tabletop exercise held 14 March, minutes in the board folder" | It has not expired |
Good to know:
- A file you upload on a control is also saved in Documents, in a folder called Control evidence.
- Any kind can have an expiry date. It must be in the future. Leave it empty for proof that doesn't expire.
- The control suggests what usually fits it, and a usual review period (for example one year for an incident response plan). The suggestion is shown, but not applied for you.
- Removing evidence from a control does not delete the document, policy or training. Deleting the document, policy or training does remove it from every control, and those controls are re-checked.
How the checks decide
Each source gives one answer per control. If sources disagree, the worst one wins: Failing beats Needs evidence, which beats Passing. A control that no source speaks for stays Not started.
Documents and notes
| What RiskFlow sees | Control |
|---|---|
| Attached, not expired | Passing |
| Attached, past its expiry date | Needs evidence |
| Nothing attached | Nothing from this source. The control stays Not started |
Policies
RiskFlow looks at the people asked to sign the policy (assigned on the policy page) and at the current version.
| What RiskFlow sees | Control |
|---|---|
| Everyone assigned has signed the current version | Passing |
| Someone hasn't signed, and 30 days have passed since they were asked (or since the latest version was uploaded, whichever is later) | Failing. The detail names them, for example "2 of 12 not signed" |
| Someone hasn't signed, but still has time | They don't count against it. A new hire doesn't turn the control red on day one |
| Nobody has been asked to sign | Needs evidence |
| The current version is older than the review period (a year for HIPAA's policy controls) | Needs evidence. Upload a reviewed version |
A new version resets signatures. Everyone signs again and gets another 30 days.
Training
| What RiskFlow sees | Control |
|---|---|
| 90% or more of the people who are due have finished | Passing |
| Less than that | Failing. The detail shows the rate and names who hasn't finished, for example "50% completed (1 of 2), target 90%" |
| Everyone's due date is still ahead | Passing. People who still have time don't count yet |
| Nobody has been assigned | Needs evidence |
The rate is finished ÷ (finished + overdue). A team can raise the target up to 100% on the evidence. It can't go below 90%. A completion older than 12 months counts as not done, because training is yearly.
Business associate agreements
The Business associate agreements control checks itself. Every vendor you have invited (and who is not revoked) needs a signed BAA: the vendor must have signed the current version of an agreement it is on.
| What RiskFlow sees | Control |
|---|---|
| Every vendor has signed a BAA | Passing: "3 vendors have a signed BAA" |
| A vendor has no signed BAA, or the BAA was replaced with a new version it hasn't signed | Failing, and it names them: "1 vendor without a signed BAA: Fax.io" |
| No vendors | Nothing from this source |
Adding a vendor turns the control red at once. Revoking the vendor, or the vendor signing, turns it green. Putting a vendor on an agreement is not enough; it has to be signed.
People who leave
Someone who leaves the team stops counting for policies and training.
When a control is re-checked
Right away, only the controls that use the thing that changed:
- you add, change or remove evidence;
- someone signs a policy, a new version is uploaded, or a policy is assigned or unassigned;
- someone finishes a training, or a training is assigned or changed;
- a vendor is invited, revoked, put on an agreement, or signs;
- a document, policy or training is deleted;
- someone is removed from the team.
Once a day, for things that change with the clock alone: an expiry date passes, a 30-day grace period ends, a due date passes, a version turns a year old, a completion turns 12 months old. So a control can show Passing for up to a day after its proof goes stale. The control's detail already lists the item as expired in that time. The daily job is described in Evidence: the daily job.
Reading a control
Open a control and its detail lists what is attached and what each check said. That is the reason for the status, for example:
Sanction policy: 2 of 12 not signed. Ada Lovelace, Ben Carter
Fix those two signatures and the control turns green on its own.
Audit trail
Everything is recorded in the Audit log under Compliance: evidence added, changed, removed and expired, and every change of a control's status, with the old and the new status. Changes made by the system, such as an expiry found by the daily job, are labelled as such.
See Frameworks and Controls for statuses and the readiness score, and ADR 009 for the design.